EP2428018B1 - A system and method for controlling policy distribution with partial evaluation - Google Patents
A system and method for controlling policy distribution with partial evaluation Download PDFInfo
- Publication number
- EP2428018B1 EP2428018B1 EP10772328.0A EP10772328A EP2428018B1 EP 2428018 B1 EP2428018 B1 EP 2428018B1 EP 10772328 A EP10772328 A EP 10772328A EP 2428018 B1 EP2428018 B1 EP 2428018B1
- Authority
- EP
- European Patent Office
- Prior art keywords
- access control
- policy
- attributes
- protected
- guard
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims description 32
- 238000011156 evaluation Methods 0.000 title claims description 24
- 230000006870 function Effects 0.000 claims description 61
- 230000003068 static effect Effects 0.000 claims description 19
- 238000004590 computer program Methods 0.000 claims description 11
- 230000009471 action Effects 0.000 claims description 8
- 230000004044 response Effects 0.000 claims description 8
- 230000008901 benefit Effects 0.000 description 12
- 238000013459 approach Methods 0.000 description 4
- 238000010586 diagram Methods 0.000 description 4
- 230000014509 gene expression Effects 0.000 description 2
- 238000005192 partition Methods 0.000 description 2
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000000926 separation method Methods 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/101—Access control lists [ACL]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/102—Entity profiles
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W28/00—Network traffic management; Network resource management
Definitions
- the present invention relates in a first aspect to a system operable to control policy distribution with partial evaluation in order to permit/deny access to a protected means.
- the present invention relates to a method for controlling policy distribution with partial evaluation in order to permit/deny access to a protected means.
- the present invention relates to at least one computer program product for controlling policy distribution with partial evaluation in order to permit/deny access to a protected means.
- XACML is an access control policy language. In practical use of XACML a large enterprise will have many different resources and lots of policies about different resources. There is a desire to make management of the policies easy to handle.
- policies may be undesirable, because policies may be sensitive/confidential and must not be disclosed to any PDP.
- Another approach is to manually decide which policies to send to which PDP. However, this represents an administrative overhead and is prone to error.
- a third approach is to use a subset of XACML for control over distribution, for instance the XACML standard has a "profile" (an additional extra piece of "appendix” we could say) by which it is possible to request a policy based on matching of the top level target only.
- profile an additional extra piece of "appendix” we could say
- this represents an administrative overhead since the policies must be kept in this form. Besides, it does not allow distribution of any XACML policy, since the policies must be in a special form where the top level target is used for distribution control. Furthermore, it is prone to error.
- the above mentioned problems are solved by a system operable to control policy distribution with partial evaluation in order to permit/deny access to a protected means according to Claim 1.
- the system comprises a storing means operable to store all access control policy functions for all protected means.
- the system also comprises a guard means operable to guard access to a protected means and to construct an access control request comprising attributes regarding the protected means.
- the system also comprises a policy decision means connected to the guard means and operable to receive the access control request from the guard means.
- the system also comprises a policy distribution means connected to the storing means, and to the policy decision means.
- the policy decision means is also operable to collect the static attributes of the protected means, and to send the static attributes to the policy distribution means, which in turn is operable to construct a partial access control request from the static attributes of the protected means, and to perform partial evaluation against the access control policy function stored in the storing means, resulting in a simplified access control policy function.
- the policy distribution means is operable to send the simplified access control policy function to the policy decision means, which in turn is operable to use the simplified access control policy function to evaluate access control requests regarding the protected means, and to return a permit/deny response to the guard means.
- each protected means is a resource, a subject, an action, an environment, or a combination of two or more of these alternatives.
- the system also comprises an input means connected to the storing means, and operable to input a new access control policy function or to amend an access control policy function in the storing means.
- a further advantage in this context is achieved if each protected means is connected to the guard means closest to the protected means.
- the storing means is in the form of a database.
- attributes are in the form of attributes which are present, attributes which are not present and attributes which are undefined.
- the above mentioned problems are also solved with a method for controlling policy distribution with partial evaluation in order to permit/deny access to a protected means according to Claim 8.
- the method is performed with the aid of a system. The method comprises the steps:
- each protected means is a resource, a subject, an action, an environment, or a combination of two or more of these alternatives.
- the method also comprises the step:
- attributes are in the form of attributes which are present, attributes which are not present and attributes which are undefined.
- the step to perform partial evaluation is performed by substituting the attributes which are present in the partial access control request with values into the access control policy function.
- the above mentioned problems are also solved with at least one computer program product according to Claim 14.
- the at least one computer program product is/are directly loadable into the internal memory of at least one digital computer, and comprises software code portions for performing the steps of the method according the present invention when the at least one product is/are run on the at least one computer.
- XACML is an access control policy language.
- An attempt to access a resource 202 is described in terms of a "Request", which lists attributes of the subject 204, the resource 202, the action and the environment 206.
- Most kinds of "facts" about the subject 204, resource 202, action and environment 206 can be described in terms of attributes.
- An attribute is an identifier, a data type and a value. It can also be described as a variable with a name (the identifier), a data type and a value.
- the request is constructed by a Policy Enforcement Point, PEP 208.
- PEP 208 The purpose of a PEP 208 is to guard access to a resource 202 and let only authorized users through.
- the PEP 208 itself does not know who is authorized, rather it submits the request to a Policy Decision Point, PDP 210, which contain policies about which requests that shall be permitted respective denied.
- PDP 210 evaluates the policies, and returns a permit/deny response to the PEP 208.
- the PEP 208 then either lets the access proceed or stops it.
- policies can be nested in a tree form. Different policies are combined using so called combining algorithms which define which policy takes precedence over another.
- the system 10 comprises a storing means 14 operable to store all access control policy functions for all protected means 12. It is pointed out that for the sake of simplicity there is only disclosed one protected means 12 in fig. 2 .
- the system 10 also comprises a guard means 16 connected to the protected means 12, and operable to guard access to the protected means 12, and to construct an access control request comprising attributes regarding the protected means 12.
- the system 10 also comprises a policy decision means 18 connected to the guard means 16 and operable to receive the access control request from the guard means 16.
- the system 10 comprises a policy distribution means 20 connected to the storing means 14 and to the policy decision means 18.
- the policy decision means 18 is in turn also operable to collect the static attributes of the protected means 12, and to send the static attributes to the policy distribution means 20.
- the policy distribution means 20 is operable to construct a partial access control request from the static attributes of the protected means 12, and to perform partial evaluation against the access control policy function stored in the storing means 14, resulting in a simplified access control policy function.
- the policy distribution means 20 is thereafter operable to send the simplified access control policy function to the policy decision means 18, which in turn is operable to use the simplified access control policy function to evaluate access control requests regarding the protected means 12, and to return a permit/deny response to the guard means 16.
- each protected means 12 is a resource, a subject, an action, an environment, or a combination of two or more of these alternatives.
- system 10 also comprises an input means 22 connected to the storing means 14 (see fig. 2 ).
- the input means 22 is operable to input a new access control policy function or to amend an access control policy function in the storing means 14.
- each protected means 12 is connected to the guard means 16 closest to the protected means 12. Although it is not disclosed in fig. 2 , it is pointed out that there can be several protected means 12 connected to the same guard means 16.
- the storing means 14 is in the form of a database 14.
- the attributes can be partitioned into attributes which are present, attributes which are not present and attributes which are undefined. Since these three sets partition the set of possible attributes, it is necessary to only define two of them and the third is implied. Typically, the set of attributes which are present and the set of undefined attributes are explicitly listed in an actual request, but this need not always to be the case.
- fig. 3 there is disclosed a flow chart of a method for controlling policy distribution with partial evaluation in order to permit/deny access to a protected means 12 (see fig. 2 ) according to the present invention.
- the method begins at block 50.
- the method continues, at block 52, with the step: with the aid of the policy decision means 18 connected to the guard means 16, to collect the static attributes of the protected means 12.
- the method continues, at block 54, with the step: to send the static attributes to the policy distribution means 20 comprised in the system 10 and connected to the policy decision means 18, and to the storing means 14.
- the storing means 14 is operable to store all access control policy functions for all protected means 12.
- the method continues, at block 56, with the step: to construct a partial access control request from the static attributes of the protected means 12.
- the method continues, at block 58, with the step: to perform partial evaluation against the access control policy function stored in the storing means 14, resulting in a simplified access control policy function. This is also performed by the policy distribution means 20.
- the method continues, at block 60, with the step: to send the simplified access control policy function to the policy decision means 18. This is also performed by the policy distribution means 20.
- the method continues, at block 62, with the step: with the aid of the guard means 16, to construct an access control request comprising attributes regarding the protected means 12.
- the method continues, at block 64, with the step: to send the access control request to the policy decision means 18. This is performed by the guard means 16.
- the method continues, at block 66, with the step: to use the simplified access control policy function to evaluate access control requests regarding the protected means 12.
- the method continues, at block 68, with the step: to return a permit/deny response to the guard means 16. This is performed by the policy decision means 18.
- the method is completed at block 70.
- each protected means 12 is a resource, a subject, an action, an environment, or a combination of two or more of these alternatives.
- the method also comprises the step: with the aid of the input means 22 comprised in the system 10 and connected to the storing means 14, to input a new access control policy function, or to amend an access control policy function in the storing means 14.
- the attributes can be partitioned into attributes which are present, attributes which are not present and attributes which are undefined. Since these three sets partition the set of possible attributes, it is necessary to only define two of them and the third is implied. Typically, the set of attributes which are present and the set of undefined attributes are explicitly listed in an actual request, but this need not always to be the case.
- the step to perform partial evaluation is performed by substituting the attributes which are present in the partial access control request with values into the access control policy function.
- Partial evaluation works on an access control policy language.
- the policy language consists of functional expressions.
- the access control policy is a functional expression formed by nesting the functional components of the language.
- At the leaf level in the functional tree there are references to the attributes in the access control request, such that selected attributes from the access control request form the inputs to the arguments of the access control policy function.
- the access control policy has a form such as below.
- F1(F2(F3(A1, A2, ...), F4(A3, A4, ...), F5(A5, A6, ...), 7) where F1, F2 and so on denote functions, and A1, A2 and so on denote references to attributes in the access control request.
- Each function may take any number of arguments and the functions may be nested arbitrarily deep.
- the topmost function (F1 in this case) returns an access control decision Permit, Deny or any of a number of error or diagnostic codes. Nested functions may return any data type.
- a partial request is an access control request which does not contain all the attributes which are expected in a full access control request. Partial evaluation is performed by substituting the attributes which are present in the partial request into the access control policy function and evaluating the function as far as possible. For instance, if in the above given example, A2, A5 and A6 are present in the partial request, but the other attributes are not, the function can be substituted as follows: F1(F2(F3(A1, a2, ...), F4(A3, A4, ...), F5(a5, a6, ...), 7)) where a2, a5 and a6 denote the values for the attributes A2, A5 and A6 respectively.
- the new access control policy function will give the same result as the original to each full request, as long as the full access control request contains the attributes which were defined in the partial request.
- FIG. 4 some computer program products 102 1 , ..., 102 n according to the present invention are schematically shown.
- n different digital computers 100 1 , ..., 100 n are shown, where n is an integer.
- n different computer program products 102 1 , ..., 102 n are shown, here shown in the form of CD discs.
- the different computer program products 102 1 , ..., 102 n are directly loadable into the internal memory of the n different computers 100 1 , ..., 100 n .
- Each computer program product 102 1 , ..., 102 n comprises software code portions for performing all the steps according to fig.
- the computer program products 102 1 , ..., 102 n may, for instance, be in the form of diskettes, RAM discs, magnetic tapes, magneto-optical discs or some other suitable products.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Theoretical Computer Science (AREA)
- Computing Systems (AREA)
- Health & Medical Sciences (AREA)
- Bioethics (AREA)
- General Health & Medical Sciences (AREA)
- Software Systems (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Databases & Information Systems (AREA)
- Storage Device Security (AREA)
Description
- The present invention relates in a first aspect to a system operable to control policy distribution with partial evaluation in order to permit/deny access to a protected means.
- According to a second aspect the present invention relates to a method for controlling policy distribution with partial evaluation in order to permit/deny access to a protected means.
- According to a third aspect the present invention relates to at least one computer program product for controlling policy distribution with partial evaluation in order to permit/deny access to a protected means.
- XACML is an access control policy language. In practical use of XACML a large enterprise will have many different resources and lots of policies about different resources. There is a desire to make management of the policies easy to handle.
- It is desirable to centralize the machinery for policy management so it is easy to manage all the policies, rather than having lots of policies spread around all over with little control over them.
- It is also desirable to make the "physical" distance between a PEP (Policy Enforcement Point) and a PDP (Policy Decision Point) short for performance reasons. Sending each request to a single central PDP in a large enterprise does not scale well. The load on the PDP will get high and the delay from the request and response in transit over a network will degrade performance.
- So it is desirable to have many PDPs around, close to the resources. These many PDPs need to be managed efficiently. Each PDP must receive the right policies about those resources (or perhaps users) which they receive requests about. But at the same time it is desirable to hide this machinery of many PDPs from the administration, and present a consolidated view of the whole enterprise to the administrators.
- Existing approaches to policy distribution as e. g. set out in
WO 2010/128926 andUS 2006/0041666 have a lot of problems. - One approach is to distribute all policies to all PDPs. This is simple and the whole enterprise looks like a single PDP to the administrators. However, distributing all policies is inefficient, because there is an overhead in network communications sending policies which are not needed at each PDP. Each PDP will have a large set of policies to evaluate, which degrades runtime performance.
- Furthermore, distributing all policies may be undesirable, because policies may be sensitive/confidential and must not be disclosed to any PDP.
- Another approach is to manually decide which policies to send to which PDP. However, this represents an administrative overhead and is prone to error.
- A third approach is to use a subset of XACML for control over distribution, for instance the XACML standard has a "profile" (an additional extra piece of "appendix" we could say) by which it is possible to request a policy based on matching of the top level target only. However, this represents an administrative overhead since the policies must be kept in this form. Besides, it does not allow distribution of any XACML policy, since the policies must be in a special form where the top level target is used for distribution control. Furthermore, it is prone to error.
- The above mentioned problems are solved by a system operable to control policy distribution with partial evaluation in order to permit/deny access to a protected means according to
Claim 1. The system comprises a storing means operable to store all access control policy functions for all protected means. The system also comprises a guard means operable to guard access to a protected means and to construct an access control request comprising attributes regarding the protected means. Furthermore, the system also comprises a policy decision means connected to the guard means and operable to receive the access control request from the guard means. The system also comprises a policy distribution means connected to the storing means, and to the policy decision means. The policy decision means is also operable to collect the static attributes of the protected means, and to send the static attributes to the policy distribution means, which in turn is operable to construct a partial access control request from the static attributes of the protected means, and to perform partial evaluation against the access control policy function stored in the storing means, resulting in a simplified access control policy function. The policy distribution means is operable to send the simplified access control policy function to the policy decision means, which in turn is operable to use the simplified access control policy function to evaluate access control requests regarding the protected means, and to return a permit/deny response to the guard means. - The main advantages with this system can be summarised in below. Policies are distributed automatically to the right resource/protected means without administrator intervention or coordination. It works for any kind of XACML policy, though some policies can be "simplified" more than others. We get a consolidated policy view for administrators for the whole enterprise. Furthermore, each PEP/guard means can get a set of resource/protected means specific policies which are located close to the PEP, and are "minimal" in that they apply only to the specific resource and all static attributes have already been calculated in the policies.
- A further advantage in this context is achieved if each protected means is a resource, a subject, an action, an environment, or a combination of two or more of these alternatives.
- Furthermore, it is an advantage in this context if the system also comprises an input means connected to the storing means, and operable to input a new access control policy function or to amend an access control policy function in the storing means.
- A further advantage in this context is achieved if each protected means is connected to the guard means closest to the protected means.
- Furthermore, it is an advantage in this context if the storing means is in the form of a database.
- A further advantage in this context is achieved if the attributes are in the form of attributes which are present, attributes which are not present and attributes which are undefined.
- The above mentioned problems are also solved with a method for controlling policy distribution with partial evaluation in order to permit/deny access to a protected means according to Claim 8. The method is performed with the aid of a system. The method comprises the steps:
- with the aid of a policy decision means connected to a guard means, both comprised in the system, to collect the static attributes of the protected means;
- to send the static attributes to a policy distribution means comprised in the system and connected to the policy decision means, and to a storing means comprised in the system and operable to store all access control policy functions for all protected means;
- to construct a partial access control request from the static attributes of the protected means;
- to perform partial evaluation against the access control policy function stored in the storing means, resulting in a simplified access control policy function;
- to send the simplified access control policy function to the policy decision means;
- with the aid of the guard means, to construct an access control request comprising attributes regarding the protected means;
- to send the access control request to the policy decision means;
- to use the simplified access control policy function to evaluate access control requests regarding the protected means; and
- to return a permit/deny response to the guard means.
- The main advantages with this method can be summarised in below. Policies are distributed automatically to the right resource/protected means without administrator intervention or coordination. It works for any kind of XACML policy, though some policies can be "simplified" more than others. We get a consolidated policy view for administrators for the whole enterprise. Furthermore, each PEP/guard means can get a set of resource/protected means specific policies which are located close to the PEP, and are "minimal" in that they apply only to the specific resource and all static attributes have already been calculated in the policies.
- A further advantage in this context is achieved if each protected means is a resource, a subject, an action, an environment, or a combination of two or more of these alternatives.
- Furthermore, it is an advantage in this context if the method also comprises the step:
- with the aid of an input means comprised in the system and connected to the storing means, to input a new access control policy function, or to amend an access control policy function in the storing means.
- A further advantage in this context is achieved if the attributes are in the form of attributes which are present, attributes which are not present and attributes which are undefined.
- Furthermore, it is an advantage in this context if the step to perform partial evaluation is performed by substituting the attributes which are present in the partial access control request with values into the access control policy function.
- The above mentioned problems are also solved with at least one computer program product according to
Claim 14. The at least one computer program product is/are directly loadable into the internal memory of at least one digital computer, and comprises software code portions for performing the steps of the method according the present invention when the at least one product is/are run on the at least one computer. - The main advantages with this computer program product can be summarised in below. Policies are distributed automatically to the right resource/protected means without administrator intervention or coordination. It works for any kind of XACML policy, though some policies can be "simplified" more than others. We get a consolidated policy view for administrators for the whole enterprise. Furthermore, each PEP/guard means can get a set of resource/protected means specific policies which are located close to the PEP, and are "minimal" in that they only apply to the specific resource and all static attributes have already been calculated in the policies.
- It will be noted that the term "comprises/comprising" as used in this description is intended to denote the presence of a given characteristic, step or component, without excluding the presence of one or more other characteristic, features, integers, steps, components or groups thereof.
- Embodiments of the invention will now be described with a reference to the accompanying drawings, in which:
-
-
Fig. 1 is a block diagram of the XACML architecture according to prior art; -
Fig. 2 is a block diagram of a system operable to control policy distribution with partial evaluation in order to permit/deny access to a protected means according to the present invention; -
Fig. 3 is a flow chart of a method for controlling policy distribution with partial evaluation in order to permit/deny access to a protected means according to the present invention; and -
Fig. 4 schematically shows a number of computer program products according to the present invention. - In
fig. 1 there is disclosed a block diagram of theXACML architecture 200, although simplified, according to the prior art. As stated before, XACML is an access control policy language. An attempt to access aresource 202 is described in terms of a "Request", which lists attributes of the subject 204, theresource 202, the action and theenvironment 206. Most kinds of "facts" about the subject 204,resource 202, action andenvironment 206 can be described in terms of attributes. An attribute is an identifier, a data type and a value. It can also be described as a variable with a name (the identifier), a data type and a value. - The request is constructed by a Policy Enforcement Point,
PEP 208. The purpose of aPEP 208 is to guard access to aresource 202 and let only authorized users through. ThePEP 208 itself does not know who is authorized, rather it submits the request to a Policy Decision Point,PDP 210, which contain policies about which requests that shall be permitted respective denied. ThePDP 210 evaluates the policies, and returns a permit/deny response to thePEP 208. ThePEP 208 then either lets the access proceed or stops it. - The fundamental purpose with this architecture is to establish separation of concerns, that is, to differentiate between policy decision making and policy enforcement. Enforcement is by its nature specific to a
particular resource 202, while a decision engine can be made general purpose and reusable. - In general policies can be nested in a tree form. Different policies are combined using so called combining algorithms which define which policy takes precedence over another.
- In
fig. 2 there is disclosed a block diagram of asystem 10 operable to control policy distribution with partial evaluation in order to permit/deny access to protected means 12 according to the present invention. Thesystem 10 comprises a storing means 14 operable to store all access control policy functions for all protected means 12. It is pointed out that for the sake of simplicity there is only disclosed one protected means 12 infig. 2 . Furthermore, thesystem 10 also comprises a guard means 16 connected to the protected means 12, and operable to guard access to the protected means 12, and to construct an access control request comprising attributes regarding the protected means 12. As is apparent infig. 2 , thesystem 10 also comprises a policy decision means 18 connected to the guard means 16 and operable to receive the access control request from the guard means 16. Furthermore, thesystem 10 comprises a policy distribution means 20 connected to the storing means 14 and to the policy decision means 18. The policy decision means 18 is in turn also operable to collect the static attributes of the protected means 12, and to send the static attributes to the policy distribution means 20. Furthermore, the policy distribution means 20 is operable to construct a partial access control request from the static attributes of the protected means 12, and to perform partial evaluation against the access control policy function stored in the storing means 14, resulting in a simplified access control policy function. The policy distribution means 20 is thereafter operable to send the simplified access control policy function to the policy decision means 18, which in turn is operable to use the simplified access control policy function to evaluate access control requests regarding the protected means 12, and to return a permit/deny response to the guard means 16. - According to a preferred embodiment of the
system 10, each protected means 12 is a resource, a subject, an action, an environment, or a combination of two or more of these alternatives. - Furthermore, according to another embodiment the
system 10 also comprises an input means 22 connected to the storing means 14 (seefig. 2 ). The input means 22 is operable to input a new access control policy function or to amend an access control policy function in the storing means 14. - According to another preferred embodiment of the
system 10, each protected means 12 is connected to the guard means 16 closest to the protected means 12. Although it is not disclosed infig. 2 , it is pointed out that there can be several protected means 12 connected to the same guard means 16. - Furthermore, according to another alternative the storing means 14 is in the form of a
database 14. - The attributes can be partitioned into attributes which are present, attributes which are not present and attributes which are undefined. Since these three sets partition the set of possible attributes, it is necessary to only define two of them and the third is implied. Typically, the set of attributes which are present and the set of undefined attributes are explicitly listed in an actual request, but this need not always to be the case.
- In
fig. 3 there is disclosed a flow chart of a method for controlling policy distribution with partial evaluation in order to permit/deny access to a protected means 12 (seefig. 2 ) according to the present invention. The method begins atblock 50. The method continues, atblock 52, with the step: with the aid of the policy decision means 18 connected to the guard means 16, to collect the static attributes of the protected means 12. Thereafter, the method continues, atblock 54, with the step: to send the static attributes to the policy distribution means 20 comprised in thesystem 10 and connected to the policy decision means 18, and to the storing means 14. The storing means 14 is operable to store all access control policy functions for all protected means 12. The method continues, atblock 56, with the step: to construct a partial access control request from the static attributes of the protected means 12. This is performed by the policy distribution means 20. Thereafter, the method continues, atblock 58, with the step: to perform partial evaluation against the access control policy function stored in the storing means 14, resulting in a simplified access control policy function. This is also performed by the policy distribution means 20. The method continues, atblock 60, with the step: to send the simplified access control policy function to the policy decision means 18. This is also performed by the policy distribution means 20. Thereafter, the method continues, atblock 62, with the step: with the aid of the guard means 16, to construct an access control request comprising attributes regarding the protected means 12. The method continues, atblock 64, with the step: to send the access control request to the policy decision means 18. This is performed by the guard means 16. Thereafter, the method continues, atblock 66, with the step: to use the simplified access control policy function to evaluate access control requests regarding the protected means 12. The method continues, atblock 68, with the step: to return a permit/deny response to the guard means 16. This is performed by the policy decision means 18. The method is completed atblock 70. - According to a preferred embodiment of the method, each protected means 12 is a resource, a subject, an action, an environment, or a combination of two or more of these alternatives.
- According to another embodiment, the method also comprises the step: with the aid of the input means 22 comprised in the
system 10 and connected to the storing means 14, to input a new access control policy function, or to amend an access control policy function in the storing means 14. - Furthermore, the attributes can be partitioned into attributes which are present, attributes which are not present and attributes which are undefined. Since these three sets partition the set of possible attributes, it is necessary to only define two of them and the third is implied. Typically, the set of attributes which are present and the set of undefined attributes are explicitly listed in an actual request, but this need not always to be the case.
- According to a preferred embodiment of the method, the step to perform partial evaluation is performed by substituting the attributes which are present in the partial access control request with values into the access control policy function.
- Partial evaluation works on an access control policy language. The policy language consists of functional expressions. The access control policy is a functional expression formed by nesting the functional components of the language. At the leaf level in the functional tree, there are references to the attributes in the access control request, such that selected attributes from the access control request form the inputs to the arguments of the access control policy function.
- Thus the access control policy has a form such as below.
F1(F2(F3(A1, A2, ...), F4(A3, A4, ...), F5(A5, A6, ...), ...))
where F1, F2 and so on denote functions, and A1, A2 and so on denote references to attributes in the access control request. Each function may take any number of arguments and the functions may be nested arbitrarily deep. The topmost function (F1 in this case) returns an access control decision Permit, Deny or any of a number of error or diagnostic codes. Nested functions may return any data type. - A partial request is an access control request which does not contain all the attributes which are expected in a full access control request. Partial evaluation is performed by substituting the attributes which are present in the partial request into the access control policy function and evaluating the function as far as possible. For instance, if in the above given example, A2, A5 and A6 are present in the partial request, but the other attributes are not, the function can be substituted as follows:
F1(F2(F3(A1, a2, ...), F4(A3, A4, ...), F5(a5, a6, ...), ...))
where a2, a5 and a6 denote the values for the attributes A2, A5 and A6 respectively. - It may be possible to simplify the function further since given the values of some attributes, some functions may be determined regardless of the value of the other arguments. For instance, the Boolean function AND(A8, A9, A10) can be evaluated to False if it can be found that at least one of its arguments is False.
- Thus, partial evaluation results in a simplified access control policy function, where parts of, or the full original access control policy function may be determined. For instance, the above given example might simplify into a new function:
F1(F2(F6(A1, A4))) - The new access control policy function will give the same result as the original to each full request, as long as the full access control request contains the attributes which were defined in the partial request.
- In
fig. 4 , some computer program products 1021, ..., 102n according to the present invention are schematically shown. Infig. 4 , n different digital computers 1001, ..., 100n are shown, where n is an integer. Infig. 4 , n different computer program products 1021, ..., 102n are shown, here shown in the form of CD discs. The different computer program products 1021, ..., 102n are directly loadable into the internal memory of the n different computers 1001, ..., 100n. Each computer program product 1021, ..., 102n comprises software code portions for performing all the steps according tofig. 3 , when the product/products 1021, ..., 102n is/are run on the computers 1001, ..., 100n. The computer program products 1021, ..., 102n may, for instance, be in the form of diskettes, RAM discs, magnetic tapes, magneto-optical discs or some other suitable products. - The invention is not limited to the described embodiments. It will be evident for those skilled in the art that many different modifications are feasible within the scope of the following Claims.
Claims (14)
- A policy distribution means (20) adapted to operate in a system (10) operable to control distribution of an access control policy to permit/deny access to a protected means (12) using partial evaluation, wherein the policy distribution means (20) is connected to a storing means (14) and to a policy decision means (18),
wherein the policy distribution means (20) receives from the policy decision means (18) static attributes of a protected means (12) and is operable to construct a partial access control request from static attributes of said protected means (12) and to perform partial evaluation against an access control policy function stored in a storing means (14) using said partial access control request, resulting in a simplified access control policy function,
wherein said policy distribution means (20) is operable to send said simplified access control policy function to said policy decision means (18), thereby enabling the policy decision means (18) to use said simplified access control policy function to evaluate access control requests regarding said protected means (12), and to return a permit/deny response to a guard means (16). - A policy distribution means (20) according to claim 1, wherein each of said set of protected means is a resource, a subject, an action, an environment, or a combination of two or more of these alternatives.
- A policy distribution means (20) according to claim 1 or 2, wherein said system (10) also comprises an input means (22) connected to said storing means (14), and operable to input a new access control policy function or to amend an access control policy function in said storing means (14).
- A policy distribution means (20) according to any one of claims 1-3, wherein each of said set of protected means is connected to said guard means (16) closest to said protected means (12).
- A policy distribution means (20) according to any one of claims 1-4, wherein said storing means (14) is in the form of a database (14).
- A policy distribution means (20) according to any one of claims 1-5, wherein said attributes are in the form of attributes which are present, attributes which are not present and attributes which are undefined.
- A system (10), comprising:a storing means (14) operable to store all access control policy functions for all protected means (12),a guard means (16) operable to guard access to a protected means (12) and to construct an access control request comprising attributes regarding said protected means (12), anda policy decision means (18) connected to said guard means (16) and operable to receive said access control request from said guard means (16),characterized by a policy distribution means (20) according to any one of Claims 1-6.
- A method for controlling, with the aid of a system (10), distribution of an access control policy to permit/deny access to a protected means (12) using partial evaluation, said method comprises the steps:- to receive, from a policy decision means (18) connected to a guard means (16), static attributes of said protected means (12) at a policy distribution means (20), which is connected to said policy decision means (18) and to a storing means (14) comprised in said system (10) and is operable to store access control policy functions for a set of protected means;- to construct, at the policy distribution means (20), a partial access control request from said static attributes of said protected means (12);- to perform, at the policy distribution means (20), partial evaluation against an access control policy function stored in said storing means (14) based on said partial access control request, resulting in a simplified access control policy function; and- to send said simplified access control policy function from the policy distribution means (20) to said policy decision means (18),wherein the storing means (14), the guard means (16), the policy decision means (18) and the policy distribution means (20) are comprised in said system.
- The method according to claim 8, further comprising the steps:- with the aid of said guard means (16), to construct an access control request comprising attributes regarding said protected means (12);- to send said access control request to said policy decision means (18);- to use said simplified access control policy function to evaluate access control requests regarding said protected means (12); and- to return a permit/deny response to said guard means (16).
- A method according to claim 8 or 9, wherein each of said set protected means is a resource, a subject, an action, an environment, or a combination of two or more of these alternatives.
- A method according to any one of claims 8-10, wherein said method also comprises the step:- with the aid of an input means (22) comprised in said system (10) and connected to said storing means (14), to input a new access control policy function, or to amend an access control policy function in said storing means (14).
- A method according to any one of claims 8-11, wherein that said attributes are in the form of attributes which are present, attributes which are not present and attributes which are undefined.
- A method according to any one of claims 8-12, wherein said step to perform partial evaluation is performed by substituting said attributes which are present in said partial access control request with values into said access control policy function.
- At least one computer program product (1021, ..., 102n) directly loadable into the internal memory of at least one digital computer (1001, ..., 100n), comprising software code portions for performing the steps of Claim 8 when said at least one product (1021, ..., 102n) is/are run on said at least one computer (1001, ..., 100n).
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
EP19197309.8A EP3651430B1 (en) | 2009-05-07 | 2010-01-14 | A system and method for controlling policy distribution with partial evaluation |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
SE0950322A SE534334C2 (en) | 2009-05-07 | 2009-05-07 | A system and procedure for controlling policy distribution with partial evaluation |
PCT/SE2010/050035 WO2010128926A1 (en) | 2009-05-07 | 2010-01-14 | A system and method for controlling policy distribution with partial evaluation |
Related Child Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
EP19197309.8A Division EP3651430B1 (en) | 2009-05-07 | 2010-01-14 | A system and method for controlling policy distribution with partial evaluation |
Publications (3)
Publication Number | Publication Date |
---|---|
EP2428018A1 EP2428018A1 (en) | 2012-03-14 |
EP2428018A4 EP2428018A4 (en) | 2017-02-08 |
EP2428018B1 true EP2428018B1 (en) | 2019-09-18 |
Family
ID=43050274
Family Applications (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
EP19197309.8A Active EP3651430B1 (en) | 2009-05-07 | 2010-01-14 | A system and method for controlling policy distribution with partial evaluation |
EP10772328.0A Active EP2428018B1 (en) | 2009-05-07 | 2010-01-14 | A system and method for controlling policy distribution with partial evaluation |
Family Applications Before (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
EP19197309.8A Active EP3651430B1 (en) | 2009-05-07 | 2010-01-14 | A system and method for controlling policy distribution with partial evaluation |
Country Status (4)
Country | Link |
---|---|
US (1) | US20120066739A1 (en) |
EP (2) | EP3651430B1 (en) |
SE (1) | SE534334C2 (en) |
WO (1) | WO2010128926A1 (en) |
Families Citing this family (8)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US8799986B2 (en) * | 2009-05-07 | 2014-08-05 | Axiomatics Ab | System and method for controlling policy distribution with partial evaluation |
US9646164B2 (en) | 2010-12-30 | 2017-05-09 | Aziomatics Ab | System and method for evaluating a reverse query |
WO2012091652A1 (en) * | 2010-12-30 | 2012-07-05 | Axiomatics Ab | A system and method for using partial evaluation for efficient remote attribute retrieval |
SE1051394A1 (en) * | 2010-12-30 | 2011-10-13 | Axiomatics Ab | A system and method for evaluating a reverse query |
US9626452B2 (en) | 2011-05-05 | 2017-04-18 | Axiomatics Ab | Fine-grained database access-control policy enforcement using reverse queries |
EP2521066A1 (en) | 2011-05-05 | 2012-11-07 | Axiomatics AB | Fine-grained relational database access-control policy enforcement using reverse queries |
US8966576B2 (en) | 2012-02-27 | 2015-02-24 | Axiomatics Ab | Provisioning access control using SDDL on the basis of a XACML policy |
US9432375B2 (en) | 2013-10-10 | 2016-08-30 | International Business Machines Corporation | Trust/value/risk-based access control policy |
Family Cites Families (8)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7051366B1 (en) * | 2000-06-21 | 2006-05-23 | Microsoft Corporation | Evidence-based security policy manager |
US9143405B2 (en) * | 2002-11-01 | 2015-09-22 | Telefonaktiebolaget L M Ericsson (Publ) | Method and system for policy-based control in a distributed network |
US20050166260A1 (en) * | 2003-07-11 | 2005-07-28 | Christopher Betts | Distributed policy enforcement using a distributed directory |
US20060200664A1 (en) * | 2005-03-07 | 2006-09-07 | Dave Whitehead | System and method for securing information accessible using a plurality of software applications |
WO2008046227A1 (en) * | 2006-10-20 | 2008-04-24 | Her Majesty The Queen, In Right Of Canada As Represented By The Minister Of Health Through The Public Health Agency Of Canada | Method and apparatus for software policy management |
EP1927930A1 (en) * | 2006-11-30 | 2008-06-04 | Sap Ag | Method and system for access control using resouce filters |
US8010991B2 (en) * | 2007-01-29 | 2011-08-30 | Cisco Technology, Inc. | Policy resolution in an entitlement management system |
US8434125B2 (en) * | 2008-03-05 | 2013-04-30 | The Boeing Company | Distributed security architecture |
-
2009
- 2009-05-07 SE SE0950322A patent/SE534334C2/en unknown
-
2010
- 2010-01-14 US US13/318,886 patent/US20120066739A1/en not_active Abandoned
- 2010-01-14 EP EP19197309.8A patent/EP3651430B1/en active Active
- 2010-01-14 EP EP10772328.0A patent/EP2428018B1/en active Active
- 2010-01-14 WO PCT/SE2010/050035 patent/WO2010128926A1/en active Application Filing
Non-Patent Citations (1)
Title |
---|
None * |
Also Published As
Publication number | Publication date |
---|---|
EP3651430A1 (en) | 2020-05-13 |
SE534334C2 (en) | 2011-07-12 |
EP2428018A1 (en) | 2012-03-14 |
SE0950322A1 (en) | 2010-11-08 |
EP3651430B1 (en) | 2022-03-23 |
EP2428018A4 (en) | 2017-02-08 |
US20120066739A1 (en) | 2012-03-15 |
WO2010128926A1 (en) | 2010-11-11 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US8799986B2 (en) | System and method for controlling policy distribution with partial evaluation | |
EP2428018B1 (en) | A system and method for controlling policy distribution with partial evaluation | |
CN107070848B (en) | Encrypting data for analytical web applications | |
US10511632B2 (en) | Incremental security policy development for an enterprise network | |
KR100968003B1 (en) | Mechanism for evaluating security risks | |
US8990900B2 (en) | Authorization control | |
US9509722B2 (en) | Provisioning access control using SDDL on the basis of an XACML policy | |
US11206262B2 (en) | Policy-based triggering of revision of access control information | |
JP2000047924A (en) | System and method for restricting database access to managed object information using permission table that specifies access right corresponding to user access right to managed object | |
JP2005259126A (en) | Metered execution of code | |
US8095959B2 (en) | Method and system for integrating policies across systems | |
US11405402B2 (en) | System and method for implementing a computer network | |
El Kateb et al. | Refactoring access control policies for performance improvement | |
US11061804B2 (en) | Application monitoring using workload metadata | |
US20210344723A1 (en) | Distributed network application security policy generation and enforcement for microsegmentation | |
US9049237B2 (en) | System and method for performing partial evaluation in order to construct a simplified policy | |
JP4225815B2 (en) | Access management system, access management method, and access management method | |
SE1051167A1 (en) | A system and method for performing partial evaluation in order to construct a simplified policy | |
US20230086475A1 (en) | System and method for synthesizing role-based access control assignments per a policy | |
US20060137021A1 (en) | Accessing protected resources via multi-identity security environments | |
US20230161892A1 (en) | System and method for securing windows discretionary access control | |
Gias Uddin et al. | ATM: an automatic trust monitoring algorithm for service software |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
PUAI | Public reference made under article 153(3) epc to a published international application that has entered the european phase |
Free format text: ORIGINAL CODE: 0009012 |
|
17P | Request for examination filed |
Effective date: 20111014 |
|
AK | Designated contracting states |
Kind code of ref document: A1 Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO SE SI SK SM TR |
|
DAX | Request for extension of the european patent (deleted) | ||
RAP1 | Party data changed (applicant data changed or rights of an application transferred) |
Owner name: AXIOMATICS AB |
|
RIN1 | Information on inventor provided before grant (corrected) |
Inventor name: RISSANEN, ERIK |
|
RAP1 | Party data changed (applicant data changed or rights of an application transferred) |
Owner name: AXIOMATICS AB |
|
RA4 | Supplementary search report drawn up and despatched (corrected) |
Effective date: 20170112 |
|
RIC1 | Information provided on ipc code assigned before grant |
Ipc: G06F 21/00 20130101ALI20170105BHEP Ipc: H04L 29/06 20060101AFI20170105BHEP Ipc: H04W 28/00 20090101ALI20170105BHEP |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: EXAMINATION IS IN PROGRESS |
|
17Q | First examination report despatched |
Effective date: 20180814 |
|
GRAP | Despatch of communication of intention to grant a patent |
Free format text: ORIGINAL CODE: EPIDOSNIGR1 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: GRANT OF PATENT IS INTENDED |
|
INTG | Intention to grant announced |
Effective date: 20190410 |
|
GRAS | Grant fee paid |
Free format text: ORIGINAL CODE: EPIDOSNIGR3 |
|
GRAA | (expected) grant |
Free format text: ORIGINAL CODE: 0009210 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: THE PATENT HAS BEEN GRANTED |
|
AK | Designated contracting states |
Kind code of ref document: B1 Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO SE SI SK SM TR |
|
REG | Reference to a national code |
Ref country code: GB Ref legal event code: FG4D |
|
REG | Reference to a national code |
Ref country code: CH Ref legal event code: EP |
|
REG | Reference to a national code |
Ref country code: DE Ref legal event code: R096 Ref document number: 602010061124 Country of ref document: DE |
|
REG | Reference to a national code |
Ref country code: AT Ref legal event code: REF Ref document number: 1182644 Country of ref document: AT Kind code of ref document: T Effective date: 20191015 |
|
REG | Reference to a national code |
Ref country code: IE Ref legal event code: FG4D |
|
REG | Reference to a national code |
Ref country code: NL Ref legal event code: MP Effective date: 20190918 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: FI Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190918 Ref country code: NO Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20191218 Ref country code: LT Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190918 Ref country code: HR Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190918 Ref country code: BG Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20191218 Ref country code: SE Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190918 |
|
REG | Reference to a national code |
Ref country code: LT Ref legal event code: MG4D |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: LV Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190918 Ref country code: GR Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20191219 |
|
REG | Reference to a national code |
Ref country code: AT Ref legal event code: MK05 Ref document number: 1182644 Country of ref document: AT Kind code of ref document: T Effective date: 20190918 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: RO Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190918 Ref country code: IT Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190918 Ref country code: PL Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190918 Ref country code: NL Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190918 Ref country code: PT Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20200120 Ref country code: ES Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190918 Ref country code: EE Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190918 Ref country code: AT Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190918 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: CZ Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190918 Ref country code: SM Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190918 Ref country code: IS Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20200224 Ref country code: SK Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190918 |
|
REG | Reference to a national code |
Ref country code: DE Ref legal event code: R097 Ref document number: 602010061124 Country of ref document: DE |
|
PLBE | No opposition filed within time limit |
Free format text: ORIGINAL CODE: 0009261 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT |
|
PG2D | Information on lapse in contracting state deleted |
Ref country code: IS |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: DK Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190918 Ref country code: IS Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20200119 |
|
26N | No opposition filed |
Effective date: 20200619 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: MC Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190918 Ref country code: SI Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190918 |
|
REG | Reference to a national code |
Ref country code: CH Ref legal event code: PL |
|
REG | Reference to a national code |
Ref country code: BE Ref legal event code: MM Effective date: 20200131 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: LU Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES Effective date: 20200114 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: CH Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES Effective date: 20200131 Ref country code: BE Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES Effective date: 20200131 Ref country code: LI Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES Effective date: 20200131 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: IE Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES Effective date: 20200114 |
|
REG | Reference to a national code |
Ref country code: DE Ref legal event code: R079 Ref document number: 602010061124 Country of ref document: DE Free format text: PREVIOUS MAIN CLASS: H04L0029060000 Ipc: H04L0065000000 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: TR Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190918 Ref country code: MT Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190918 Ref country code: CY Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190918 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: MK Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20190918 |
|
PGFP | Annual fee paid to national office [announced via postgrant information from national office to epo] |
Ref country code: GB Payment date: 20231215 Year of fee payment: 15 |
|
PGFP | Annual fee paid to national office [announced via postgrant information from national office to epo] |
Ref country code: FR Payment date: 20231215 Year of fee payment: 15 |
|
PGFP | Annual fee paid to national office [announced via postgrant information from national office to epo] |
Ref country code: DE Payment date: 20231218 Year of fee payment: 15 |